Extracted

• • Target
    7ec03859303aec5c53080213d3fa7d550b434be1edb820cba7d08d6461e7b8f5
  • Size 45KB
  • SHA256 7ec03859303aec5c53080213d3fa7d550b434be1edb820cba7d08d6461e7b8f5
  • MD5 b78862499485c1bbdf109e8235ff581c
  • SHA1 8a986b3536185b03c1fa84ec15bfd32fff8c3ee4
  • SHA512 83ea4457ba58fcb712de2c1fa8457bf0188f72f9956128237c6e18f79299fb688667090a410ff1a8ff255411ece10d31bdfb5fb2a840a438f7c743295804789f
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1n+GtCVnJtHuPI+zjbIgX3i30hzaIfJKjqNnsvB0:cu6YepTPso2M+TB3+3bfXS3Wz18eeZdW
  • TLSH
    T1B3231B003BE8813BF2BE4FB898F26145867AF6677602D64D1CC451DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2